docs(standards): a fourth review rule — the instrument that answers an adjacent question

[wshallwshall]

The three rules in Secure_Development_Standards §3 catch prose that is true and misleading. They do not catch the failure that produced eleven retractions across four parallel sessions on 2026-08-02: a claim that is false when written, while feeling measured, because the instrument answered a question adjacent to the one asked.

Each instance was verified by the session that made it:

instrument	what it returns	what was asked
git diff on a staged file	is there an unstaged delta	is the tree dirty
merge-base --is-ancestor	is this an ancestor	did this work land — squash-merge: always no
a hash inequality	are these different	is the installed copy worse
session-start banner	who was live when it printed	who is live now
grep -c $'\r$' over git diff	does the diff render a CR	does the file contain CRLF
$? after cmd | tail	did tail succeed	did the gate pass
Actions ?filter=latest	what did the latest attempt do	what did the suite ever do
job conclusion	did the job pass	did the step pass

Two findings make this actionable rather than a scolding:

• Re-reading caught none of the eleven. A check that could fail caught one immediately. Re-reading confirms what you meant; it cannot test what you wrote.
• None was a stale fact — every one was wrong at birth. "ADR 0154 increment B: synchronous captured-downstream reply (reply_from) #119 never merged (it died on a CI timeout)" was never true at any instant: that PR's timeline carries exactly one closed event, simultaneous with merged. Dating a claim therefore does not protect against this class; only re-deriving it does.

So the rule is a prophylactic — checkable before the sentence exists, and without a peer: name the question, name what the instrument returns, confirm they are the same sentence. That is what distinguishes it from the three above it, which need a reviewer to arrive.

Also adds the one-liner to CLAUDE.md §11 alongside the other three, per the provenance note's own reasoning: an instruction that short cannot meaningfully drift, and a pointer nobody follows mid-task changes no behaviour.

No version-history row. The "Reviewing security prose" subsection carries none — it was added in 39990f8c without one — so additions there set no bump precedent. No change to the SSDF / ASVS / HIPAA mappings.

Attribution: named by the repo-security-review session, which applied it to its own four retractions and found four for four; instances contributed by the ci-margin-correction, announce-hook, sandbox-codec and ADR 0154 sessions, each of which had made one. Docs-only, 2 files, +27/-1.

---

One further item, recorded here so it is findable in history rather than lost with a scratch file: BACKLOG #340 has one verified paragraph offered and not written — that a merge queue distinguishes the invalidations that were the gate working from the ones that were not, with nobody adjudicating, which hand coordination structurally cannot because a freeze is global by construction: it stops everything or nothing. Evidence: of the four bumps PR #136 took, two were legitimate (#136, #143 and #144 all edit docs/BACKLOG.md) and two were not (#106's coord-script change, the deps/ASVS pair). It slots under The largest cost is protocol, not throughput. Left unwritten because it arrived after #143 and #144 had merged and did not warrant a third CI cycle on the item documenting the cost of exactly that.